Is CVE-2026-34226 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34226 being exploited in the wild.

How severe is CVE-2026-34226?

High severity, with a CVSS score of 7.5, published 27 March 2026.

Which products and versions are affected?

happy-dom (npm) SEMVER:introduced=0,fixed=20.8.9.

Is there a fix for CVE-2026-34226?

Yes. happy-dom (npm): upgrade to 20.8.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34226 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34226?

Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34226: capricorn86 Happy DOM cookie leakage in fetch requests

CVE-2026-34226 · Severity: high · CVSS 7.5 · Published 2026-03-27

Happy DOM, a tool used to simulate web browser environments for testing and automation, contains a flaw that can leak sensitive login information. When making web requests, the software may incorrectly send cookies belonging to the current page to a completely different destination. This could allow an attacker to intercept session tokens or private user data if they can influence where the software sends its requests.

Technologies: happy-dom (npm). Vendors: npm.

Quick answers

Is CVE-2026-34226 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34226 being exploited in the wild.
How severe is CVE-2026-34226?: High severity, with a CVSS score of 7.5, published 27 March 2026.
Which products and versions are affected?: happy-dom (npm) SEMVER:introduced=0,fixed=20.8.9.
Is there a fix for CVE-2026-34226?: Yes. happy-dom (npm): upgrade to 20.8.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34226 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34226?: Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

happy-dom (npm): upgrade to 20.8.9 or later
```
npm install happy-dom@20.8.9
```

Technical details

A vulnerability exists in Happy DOM's fetch implementation where the 'credentials: include' option causes the library to attach cookies from the current window.location (Origin A) to a request targeting a different destination (Origin B). The root cause is located in the FetchRequestHeaderUtility and CookieContainer components, which failed to properly validate that cookies matched the target request URL before inclusion. An attacker who can control the destination of a fetch request initiated within a Happy DOM environment can capture cookies belonging to the environment's current origin. This issue is fixed in version 20.8.9 by ensuring cookie matching logic strictly adheres to the target URL.

Affected products

capricorn86 happy-dom < 20.8.9
Red Hat Red Hat Ansible Automation Platform 2 2

Identifiers

CVE-2026-34226
GHSA-w4gp-fjgq-3q4g

Timeline

2026-03-26: patched: Version 20.8.9 released to address the cookie leakage.
2026-03-27: disclosed: Security advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.